2

I am attempting to erect a set of Docker or LXC containers, each with their own routable IP address. The containing host is actually a VM running within RedHat Enterprise Virtualization, which is a re-branded and very old version of oVirt. In our datacenter, we are using tagged VLANs, and within RHEV, these VLANs are selectable via different "LAN Profiles". I hope to put the containers all on the same VLAN/profile as the Host container. I hope to allow each container to have one virtual LAN device with its own MAC.

The containing VM has interface eth0. By following this guide ("With macvalan devices"), I created a macvlan in bridge mode and assigned it to the container. For our purposes, we will say 10.12.0.117/21 is a routable address the container should have, and 10.12.7.254 is its gateway.

# docker run -d --name test centos7
# dockpid=$(docker inspect --format '{{ .State.Pid }}' test)
# ip link add eth0p0 link eth0 type macvlan mode bridge
# ip link set netns $dockpid eth0p0
# nsenter -t $dockpid -n ip link del eth0
# nsenter -t $dockpid -n ip addr add 10.12.0.117/21 dev eth0p0
# nsenter -t $dockpid -n ip route add default via 10.12.7.254 dev eth0p0

It's not pingable. In fact, using tcpdump on eth0, and arping from another node on the network, I can see the arp requests getting TO the container, and I can see the container responding (with its randomly-generated MAC), but those ARP responses don't seem to get back to the other host (as seen by TCP/IP).

I also tried with lxc, creating the interface in a simple fashion:

# ip link add link eth0 eth4 type macvlan

If I give it an IP address and UP the device, the IP becomes pingable on the LAN. But not when I configure the container:

lxc.network.type = phys
lxc.network.flags = up
lxc.network.link = eth4

and then manually configuring the IP and routing. Now its unpingable as with docker.

If, by contrast, I use RHEV-M to create an additional network interface with the same profile, attach it to the VM, and then within the VM assign this new interface (eth2) to the container's namespace, everything works just fine. So I'm guessing this has something to do with RHEV and forwarding of ARP requests from the inside.

BTW: I don't have root on the RHEVM VM's hypervisor. (But I can ask politely if I can get it.)

Is there an obvious solution to this? Does anyone have troubleshooting tips? What am I missing?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.